From 5102d4fb0b5d3e1dafcd98dadac88b938187ae95 Mon Sep 17 00:00:00 2001 From: Tim Purschke Date: Thu, 25 May 2023 16:35:50 +0200 Subject: [PATCH 1/4] removing artefact --- configNormalized.json | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 configNormalized.json diff --git a/configNormalized.json b/configNormalized.json deleted file mode 100644 index e69de29bb..000000000 From c70ca90017f90a2165306b2adabd7f8f2074ee71 Mon Sep 17 00:00:00 2001 From: Tim Purschke Date: Fri, 2 Jun 2023 08:09:34 +0200 Subject: [PATCH 2/4] FortiOS importer add support for internet services --- documentation/revision-history.md | 6 +++ inventory/group_vars/all.yml | 2 +- .../fortiosmanagementREST/fOS_getter.py | 18 ++++--- .../fortiosmanagementREST/fOS_network.py | 49 +++++++++++++------ .../fortiosmanagementREST/fOS_rule.py | 26 ++++++++-- .../fortiosmanagementREST/fOS_service.py | 2 +- .../fortiosmanagementREST/fwcommon.py | 4 +- 7 files changed, 77 insertions(+), 30 deletions(-) diff --git a/documentation/revision-history.md b/documentation/revision-history.md index 0e3fe1d80..eb2454c2a 100644 --- a/documentation/revision-history.md +++ b/documentation/revision-history.md @@ -305,3 +305,9 @@ adding report template format fk and permissions - Reporting: new lean export format JSON for resolved and tech reports - hotfix FortiGate FortiOS REST importer: removing reference to gw_networking - hotfix CPR8x importer: handling of empty section headers + +### 6.4.1 02.06.2023 MAIN +- FortiOS importer: add support for internet services + +### 6.4.2 xx.06.2023 DEVELOP +- CPR8x importer: basic support for inline layers diff --git a/inventory/group_vars/all.yml b/inventory/group_vars/all.yml index a9e757dbe..995214883 100644 --- a/inventory/group_vars/all.yml +++ b/inventory/group_vars/all.yml @@ -1,5 +1,5 @@ ### general settings -product_version: "6.4" +product_version: "6.4.1" ansible_user: "{{ lookup('env', 'USER') }}" ansible_become_method: sudo ansible_python_interpreter: /usr/bin/python3 diff --git a/roles/importer/files/importer/fortiosmanagementREST/fOS_getter.py b/roles/importer/files/importer/fortiosmanagementREST/fOS_getter.py index b53b2c289..181b47621 100644 --- a/roles/importer/files/importer/fortiosmanagementREST/fOS_getter.py +++ b/roles/importer/files/importer/fortiosmanagementREST/fOS_getter.py @@ -50,14 +50,16 @@ def update_config_with_fortiOS_api_call(config_json, api_url, result_name, show_ limit = int(limit) returned_new_objects = True full_result = [] - while returned_new_objects: - range = [offset, limit] - result = fortiOS_api_call(api_url) - full_result.extend(result) - offset += limit - if len(result)0: + rule['rule_src'] = list_delimiter.join([d['name'] for d in rule_orig['internet-service-src-name']]) + if 'internet-service-name' in rule_orig and len(rule_orig['internet-service-name'])>0: + rule['rule_dst'] = list_delimiter.join([d['name'] for d in rule_orig['internet-service-name']]) + + # add ipv6 addresses + rule_src_v6 = [d['name'] for d in rule_orig['srcaddr6']] + rule_dst_v6 = [d['name'] for d in rule_orig['dstaddr6']] + if len(rule_src_v6)>0: + if len(rule['rule_src'])>0: + rule['rule_src'] = list_delimiter.join(rule['rule_src'].split(list_delimiter) + rule_src_v6) + else: + rule['rule_src'] = list_delimiter.join(rule_src_v6) + if len(rule_dst_v6)>0: + if len(rule['rule_dst'])>0: + rule['rule_dst'] = list_delimiter.join(rule['rule_dst'].split(list_delimiter) + rule_dst_v6) + else: + rule['rule_dst'] = list_delimiter.join(rule_dst_v6) + # add zone information if len(rule_orig['srcintf'])>0: src_obj_zone = fOS_zone.add_zone_if_missing (config2import, rule_orig['srcintf'][0]['name'], import_id) rule.update({ 'rule_from_zone': src_obj_zone }) # todo: currently only using the first zone diff --git a/roles/importer/files/importer/fortiosmanagementREST/fOS_service.py b/roles/importer/files/importer/fortiosmanagementREST/fOS_service.py index 263bb7258..9a5f57073 100644 --- a/roles/importer/files/importer/fortiosmanagementREST/fOS_service.py +++ b/roles/importer/files/importer/fortiosmanagementREST/fOS_service.py @@ -84,7 +84,7 @@ def normalize_svcobjects(full_config, config2import, import_id, scope): addObject(svc_objects, 'simple', name, color, 1, None, None, None, import_id, full_config=full_config) added_svc_obj += 1 else: - logger.warning("Unknown service found: " + obj_orig['name'] +', proto: ' + obj_orig['protocol']) + logger.warning("Unknown service protocol found: " + obj_orig['name'] +', proto: ' + obj_orig['protocol']) elif type == 'group': addObject(svc_objects, type, name, color, 0, None, member_names, session_timeout, import_id, full_config=full_config) else: diff --git a/roles/importer/files/importer/fortiosmanagementREST/fwcommon.py b/roles/importer/files/importer/fortiosmanagementREST/fwcommon.py index 8d5ba92da..5b16cf669 100644 --- a/roles/importer/files/importer/fortiosmanagementREST/fwcommon.py +++ b/roles/importer/files/importer/fortiosmanagementREST/fwcommon.py @@ -18,7 +18,9 @@ nw_obj_types = ['firewall/address', 'firewall/address6', 'firewall/addrgrp', - 'firewall/addrgrp6', 'firewall/ippool', 'firewall/vip'] + 'firewall/addrgrp6', 'firewall/ippool', 'firewall/vip', + 'firewall/internet-service', 'firewall/internet-service-group'] + # internet-service is not a service as such but is used as dest (mainly) svc_obj_types = ['application/list', 'application/group', # 'application/categories', #'application/custom', From df2808ac8fffa16beb062995076e2a7f8cf8ee33 Mon Sep 17 00:00:00 2001 From: Tim Purschke Date: Fri, 2 Jun 2023 09:28:41 +0200 Subject: [PATCH 3/4] api hasura upgrade to 2.26.0 --- inventory/group_vars/apiserver.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventory/group_vars/apiserver.yml b/inventory/group_vars/apiserver.yml index 7abece02b..36b473d53 100644 --- a/inventory/group_vars/apiserver.yml +++ b/inventory/group_vars/apiserver.yml @@ -8,7 +8,7 @@ api_hasura_admin_test_password: "not4production" api_user_email: "{{ api_user }}@{{ api_network_listening_ip_address }}" api_home: "{{ fworch_home }}/api" api_hasura_cli_bin: "{{ fworch_home }}/api/bin/hasura" -api_hasura_version: "v2.24.1" +api_hasura_version: "v2.26.0" api_project_name: api api_no_metadata: false api_rollback_is_running: false From 55ed0a860eadeef421b81af5810f7e9de910deb5 Mon Sep 17 00:00:00 2001 From: Tim Purschke Date: Fri, 2 Jun 2023 15:08:22 +0200 Subject: [PATCH 4/4] adding dummy service "Internet Service" --- .../importer/fortiosmanagementREST/fOS_rule.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/roles/importer/files/importer/fortiosmanagementREST/fOS_rule.py b/roles/importer/files/importer/fortiosmanagementREST/fOS_rule.py index 25beca9fa..ff2015dfa 100644 --- a/roles/importer/files/importer/fortiosmanagementREST/fOS_rule.py +++ b/roles/importer/files/importer/fortiosmanagementREST/fOS_rule.py @@ -96,8 +96,10 @@ def normalize_access_rules(full_config, config2import, import_id, mgm_details={} # handling internet-service rules - no mixed mode between (src/dst) and internet service (src), so overwriting) if 'internet-service-src-name' in rule_orig and len(rule_orig['internet-service-src-name'])>0: rule['rule_src'] = list_delimiter.join([d['name'] for d in rule_orig['internet-service-src-name']]) + set_service_field_internet_service(rule, config2import, import_id) if 'internet-service-name' in rule_orig and len(rule_orig['internet-service-name'])>0: rule['rule_dst'] = list_delimiter.join([d['name'] for d in rule_orig['internet-service-name']]) + set_service_field_internet_service(rule, config2import, import_id) # add ipv6 addresses rule_src_v6 = [d['name'] for d in rule_orig['srcaddr6']] @@ -138,6 +140,18 @@ def normalize_access_rules(full_config, config2import, import_id, mgm_details={} rule_number += 1 # nat rules have their own numbering config2import.update({'rules': rules}) +def set_service_field_internet_service(rule, config2import, import_id): + # check if dummy service "Internet Service" already exists and create if not + found_internet_service_obj = next((item for item in config2import['service_objects'] if item["svc_name"] == "Internet Service"), None) + if found_internet_service_obj is None: + config2import['service_objects'].append({ + 'svc_name': 'Internet Service', 'svc_typ': 'group', 'svc_uid': 'Internet Service', 'control_id': import_id + }) + + # set service to "Internet Service" + rule['rule_svc'] = 'Internet Service' + rule['rule_svc_refs'] = 'Internet Service' + # pure nat rules def normalize_nat_rules(full_config, config2import, import_id, jwt=None):